2018

A vulnerability in the Interactive Voice Response (IVR) management connection interface for Cisco Unified Customer Voice

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. The software installs a privileged h

CactusVPN 5.3.6 for macOS contains a root privilege escalation vulnerability through a setuid root binary called runme.

A CSRF issue was found in var/www/html/files.php in DanWin hosting through 2018-02-11 that allows arbitrary remote users

IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Tra

Tiki 17.1 does not validate user input for special characters; consequently, a CSV Injection attack can open a CMD.EXE o

It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a

Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3, 3.3.1, 3.3.2, and 3.4 allows re

An issue was discovered in Reprise License Manager 11.0. This vulnerability is a Path Traversal where the attacker, by c

The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 al

This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-2

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-2

An issue was discovered on Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) devices. Remote attackers can obtain

An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/config_db.php c

OXID eShop Community Edition before 6.0.0 RC3 (development), 4.10.x before 4.10.6 (maintenance), and 4.9.x before 4.9.11

OXID eShop Community Edition before 6.0.0 RC2 (development), 4.10.x before 4.10.5 (maintenance), and 4.9.x before 4.9.10

id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd numbe

Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary op

A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remot

XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing s

smart/calculator/gallerylock/CalculatorActivity.java in the "Photo,Video Locker-Calculator" application through 18 for A

The "Photo,Video Locker-Calculator" application 12.0 for Android has android:allowBackup="true" in AndroidManifest.xml,

The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of

The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denia

SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 al

SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote

Unisys Stealth 3.3 Windows endpoints before 3.3.016.1 allow local users to gain access to Stealth-enabled devices by lev

The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted re

Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory

An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an e

application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or addin

IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the

IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the

IBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the

An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST re

The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE messa

The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer

In Bravo Tejari Procurement Portal, uploaded files are not properly validated by the application either on the client or

Cross-site request forgery (CSRF) vulnerability in esop/toolkit/profile/regData.do in Bravo Tejari Procurement Portal al

An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing

An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct req

An issue was discovered in iDashboards 9.6b. It allows remote attackers to obtain sensitive information via a direct req

In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distribute

An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When usi

A DLL Hijacking vulnerability in Trend Micro's User-Mode Hooking Module (UMH) could allow an attacker to run arbitrary c

A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could al

The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa

Untrusted search path vulnerability in FLET'S v4 / v6 address selection tool allows an attacker to gain privileges via a

Untrusted search path vulnerability in "FLET'S Azukeru Backup Tool" version 1.5.2.6 and earlier allows an attacker to ga